Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 09:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
-
Size
486KB
-
MD5
751baccf0f3b8889c3541aa95c467899
-
SHA1
57c6fb5ff1ee482bd4d57623475d5680f321eec9
-
SHA256
8b75c61432b538ce7e6554b5ed889d4573fecd5852a33920711ec5109a4f7151
-
SHA512
2721a08e669e2c0dd94d0968281e70d47b5ef6d8444a16e110a2a91bc0e2669ba83ef721e3e03a217f9021465937bff1636c28df7b072c82b569c6b9b5285803
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7eqCYVLg/xEaYuJEBfKFUvqzxGHNpfiScLSjj:UU5rCOTeiDtL1kPQBSKvqsf6mK2NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4460 6A24.tmp 4668 6AD0.tmp 4944 6B5C.tmp 1784 6C18.tmp 5116 6D02.tmp 4452 6D9E.tmp 4696 6E1B.tmp 5032 6EE6.tmp 3192 6F83.tmp 4160 701F.tmp 2516 709C.tmp 3468 7138.tmp 4428 7232.tmp 1000 72CE.tmp 2212 734B.tmp 1540 73D8.tmp 1372 7465.tmp 2700 74F1.tmp 4644 75BC.tmp 1108 7659.tmp 2472 7733.tmp 2428 78F9.tmp 3052 7995.tmp 1080 7A41.tmp 1560 7B2B.tmp 3328 7BC7.tmp 392 7C44.tmp 3976 7D0F.tmp 4952 7DDB.tmp 4476 7E77.tmp 4512 7EF4.tmp 1572 7F90.tmp 436 802C.tmp 2784 80A9.tmp 4256 8136.tmp 536 81C3.tmp 3404 8230.tmp 3264 82AD.tmp 3472 832A.tmp 4760 8397.tmp 4352 8424.tmp 3864 8491.tmp 992 851E.tmp 3932 85BA.tmp 4636 8666.tmp 3764 86F3.tmp 4740 879F.tmp 632 883B.tmp 1020 88E7.tmp 4504 8964.tmp 1168 89B2.tmp 1868 8A3E.tmp 3196 8AAC.tmp 4412 8B38.tmp 2476 8BB5.tmp 2672 8C52.tmp 1864 8CDE.tmp 376 8D6B.tmp 3092 8DE8.tmp 4088 8E75.tmp 852 8EF2.tmp 3832 8F4F.tmp 4444 8FDC.tmp 4364 903A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4404 wrote to memory of 4460 4404 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 84 PID 4404 wrote to memory of 4460 4404 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 84 PID 4404 wrote to memory of 4460 4404 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 84 PID 4460 wrote to memory of 4668 4460 6A24.tmp 85 PID 4460 wrote to memory of 4668 4460 6A24.tmp 85 PID 4460 wrote to memory of 4668 4460 6A24.tmp 85 PID 4668 wrote to memory of 4944 4668 6AD0.tmp 86 PID 4668 wrote to memory of 4944 4668 6AD0.tmp 86 PID 4668 wrote to memory of 4944 4668 6AD0.tmp 86 PID 4944 wrote to memory of 1784 4944 6B5C.tmp 87 PID 4944 wrote to memory of 1784 4944 6B5C.tmp 87 PID 4944 wrote to memory of 1784 4944 6B5C.tmp 87 PID 1784 wrote to memory of 5116 1784 6C18.tmp 88 PID 1784 wrote to memory of 5116 1784 6C18.tmp 88 PID 1784 wrote to memory of 5116 1784 6C18.tmp 88 PID 5116 wrote to memory of 4452 5116 6D02.tmp 89 PID 5116 wrote to memory of 4452 5116 6D02.tmp 89 PID 5116 wrote to memory of 4452 5116 6D02.tmp 89 PID 4452 wrote to memory of 4696 4452 6D9E.tmp 90 PID 4452 wrote to memory of 4696 4452 6D9E.tmp 90 PID 4452 wrote to memory of 4696 4452 6D9E.tmp 90 PID 4696 wrote to memory of 5032 4696 6E1B.tmp 91 PID 4696 wrote to memory of 5032 4696 6E1B.tmp 91 PID 4696 wrote to memory of 5032 4696 6E1B.tmp 91 PID 5032 wrote to memory of 3192 5032 6EE6.tmp 92 PID 5032 wrote to memory of 3192 5032 6EE6.tmp 92 PID 5032 wrote to memory of 3192 5032 6EE6.tmp 92 PID 3192 wrote to memory of 4160 3192 6F83.tmp 93 PID 3192 wrote to memory of 4160 3192 6F83.tmp 93 PID 3192 wrote to memory of 4160 3192 6F83.tmp 93 PID 4160 wrote to memory of 2516 4160 701F.tmp 94 PID 4160 wrote to memory of 2516 4160 701F.tmp 94 PID 4160 wrote to memory of 2516 4160 701F.tmp 94 PID 2516 wrote to memory of 3468 2516 709C.tmp 95 PID 2516 wrote to memory of 3468 2516 709C.tmp 95 PID 2516 wrote to memory of 3468 2516 709C.tmp 95 PID 3468 wrote to memory of 4428 3468 7138.tmp 96 PID 3468 wrote to memory of 4428 3468 7138.tmp 96 PID 3468 wrote to memory of 4428 3468 7138.tmp 96 PID 4428 wrote to memory of 1000 4428 7232.tmp 97 PID 4428 wrote to memory of 1000 4428 7232.tmp 97 PID 4428 wrote to memory of 1000 4428 7232.tmp 97 PID 1000 wrote to memory of 2212 1000 72CE.tmp 98 PID 1000 wrote to memory of 2212 1000 72CE.tmp 98 PID 1000 wrote to memory of 2212 1000 72CE.tmp 98 PID 2212 wrote to memory of 1540 2212 734B.tmp 99 PID 2212 wrote to memory of 1540 2212 734B.tmp 99 PID 2212 wrote to memory of 1540 2212 734B.tmp 99 PID 1540 wrote to memory of 1372 1540 73D8.tmp 100 PID 1540 wrote to memory of 1372 1540 73D8.tmp 100 PID 1540 wrote to memory of 1372 1540 73D8.tmp 100 PID 1372 wrote to memory of 2700 1372 7465.tmp 101 PID 1372 wrote to memory of 2700 1372 7465.tmp 101 PID 1372 wrote to memory of 2700 1372 7465.tmp 101 PID 2700 wrote to memory of 4644 2700 74F1.tmp 102 PID 2700 wrote to memory of 4644 2700 74F1.tmp 102 PID 2700 wrote to memory of 4644 2700 74F1.tmp 102 PID 4644 wrote to memory of 1108 4644 75BC.tmp 103 PID 4644 wrote to memory of 1108 4644 75BC.tmp 103 PID 4644 wrote to memory of 1108 4644 75BC.tmp 103 PID 1108 wrote to memory of 2472 1108 7659.tmp 104 PID 1108 wrote to memory of 2472 1108 7659.tmp 104 PID 1108 wrote to memory of 2472 1108 7659.tmp 104 PID 2472 wrote to memory of 2428 2472 7733.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"23⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"24⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"25⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"26⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"27⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"28⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"29⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"30⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"31⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"32⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"33⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"34⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"35⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"36⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"37⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"38⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"39⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"40⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"41⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"42⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"43⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"44⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"45⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"46⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"47⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"48⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"49⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"50⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"51⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"52⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"53⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"54⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"55⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"56⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"57⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"58⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"59⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"60⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"61⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"62⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"63⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"64⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"65⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"66⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"67⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"68⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"69⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"70⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"71⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"73⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"74⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"75⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"76⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"77⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"78⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"79⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"80⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"81⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"82⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"83⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"84⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"85⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"86⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"87⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"88⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"89⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"90⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"91⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"92⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"93⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"94⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"95⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"96⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"97⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"98⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"99⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"100⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"101⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"102⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"103⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"104⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"105⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"106⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"107⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"108⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"109⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"110⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"111⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"112⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"113⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"114⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"115⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"117⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"118⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"119⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"120⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"121⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"122⤵PID:1164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-